home

archiv.fagms.de

Domain Information

Server location:
Hessen, Germany (DE)

ASN:
AS12312 ECOTEL ecotel communication ag,DE

Root domain:
fagms.de

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Installer.Babylon.P
100.00%

Malwarebytes
PUP.Optional.Babylon.A
100.00%

VIPRE Antivirus
Babylon
100.00%

Baidu Antivirus
Trojan.Win32.Toolbar
100.00%

ESET NOD32
Win32/Toolbar.Babylon (variant)
100.00%

McAfee
Artemis!77445EC53390
100.00%

Trend Micro House Call
TROJ_GEN.F47V1215
100.00%

Dr.Web
Adware.Downware.1733
100.00%

Comodo Security
UnclassifiedMalware
100.00%

Emsisoft Anti-Malware
Riskware.Win32.Toolbar.Babylon.AMN
100.00%

NANO AntiVirus
Riskware.Win32.Babylon.craswq
100.00%

Bkav FE
W32.Clod95a.Trojan
100.00%

AegisLab AV Signature
W32.Sality
100.00%

Agnitum Outpost
PUA.Toolbar.Babylon
100.00%

Fortinet FortiGate
Riskware/Toolbar_Babylon
100.00%

The domain archiv.fagms.de has been seen to resolve to the following IP address.

62.27.38.101
fagms.net
December 27, 2013

File downloads found at URLs served by archiv.fagms.de.

18 / 68    (Adware)
http://archiv.fagms.de/.../r?EMID=09A029H7VHPC73GPO9E057E2801QLBSCE  (babylon10_setup.exe)

The following 2 files have been seen to comunicate with archiv.fagms.de in live environments.

TCP » 62.27.38.101:80
new_chrome.exe (1stBrowser by The 1stBrowser Authors)

TCP » 62.27.38.101:80
INCMAIL.EXE (IncrediMail by IncrediMail)

gamigo.com

orange.es

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.